Web Shop Maintenance Mode

When you need to close your web shop, for example while your game servers are down, switch it into maintenance mode from your game server. Players see the web shop's maintenance screen instead of the shop until you switch it off. They stay signed in.

What players see and when

The two-minute bound also covers a page that is still waiting to reload after an earlier catalog refresh for every player.

When you switch maintenance mode off, players on the maintenance screen see the shop again when they reload the page or return to it.

Authenticate the request

Both endpoints are server-to-server and accept HMAC signatures only. Sign each request with your ingress secret in the x-stash-hmac-signature header, as described in HMAC signing:

• For POST, sign the exact body bytes you send.
• For GET, sign an empty body: the signed string is "<unixMillisTimestamp>.".

The deprecated X-Stash-Api-Key header is not accepted on these endpoints. The call always applies to the web shop of the app named in the signature.

Switch maintenance mode on or off

Call Set maintenance mode (POST /sdk/server/shop/maintenance) with enabled set to true to switch it on, or false to switch it off.

curl -X POST https://api.stash.gg/sdk/server/shop/maintenance \
  -H "Content-Type: application/json" \
  -H "x-stash-hmac-signature: v1;<appId>;<unixMillisTimestamp>;<base64-hmac>" \
  -d '{"enabled":true}'

Stash returns the resulting state. since is the time maintenance mode was switched on, in RFC 3339 format:

{ "enabled": true, "since": "2026-11-17T09:00:00Z" }

While maintenance mode is off, since is null:

{ "enabled": false, "since": null }

enabled is required. A request without it, including an empty body, {} or a misspelled field name, is refused with 400 and changes nothing.

The call is idempotent, so retries are safe:

• Switching on a shop that is already in maintenance mode succeeds and keeps the original since.
• Switching off a shop that is not in maintenance mode succeeds and changes nothing.

Read the current state

Call Get maintenance mode (GET /sdk/server/shop/maintenance). The response has the same shape as the one above.

Call limits

Limits are counted per shop, in 60-second windows. Every authenticated call counts, including one refused with 400.

Above the limit, Stash returns 429 with a RetryInfo detail whose retryDelay says how long to wait until the window ends, for example:

{ "@type": "type.googleapis.com/google.rpc.RetryInfo", "retryDelay": "60s" }

A maintenance window needs two calls: one to switch on and one to switch off. Retry with backoff and wait for retryDelay after a 429; do not retry in a tight loop. If your server spends all 10 Set maintenance mode calls in a window, a call to switch maintenance mode off is refused until the window ends.